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REMARKS/ARGUMENTS 

I. Status of the Claims 

Prior to entry of this amendment, claims 1-33 are pending in the application. No 
claims have been canceled, but new claims 7, 8, 18, 19, 28 and 29 have been amended, and 
claims 34-38 have been added. Hence, following entry of this amendment, claims 1-38 stand 
pending for examination. 

n. New and Amended Claims 

Claims 7, 8, 18, 19, 28 and 29 each have been amended to recite "receiving from 
a user a selection of said first work flow. Support for these amendments can be found, inter alia, 
at lines 9-11 on page 47 of the application. 

Claims 34-36 have been added by this amendment. Claim 34, which depends 
from claim 1, recites that "said target is a target identity profile, and . . . said task comprises 
managing said target identity profile." Support for this claim can be found, inter alia, at lines 5-7 
on page 44 of the application and at line 3 on page 103 of the application. 

Claim 35, which depends from claim 34, recites, "managing said identity profile 
comprises one or more tasks selected from the group consisting of: creating a user, deleting a 
user, changing a user attribute, creating a group, deleting a group, and changing a group 
attribute." Support for this claim can be found, inter alia, in Table 1 on pages 36-37 of the 
application. 

Claim 36, which also depends from claim 34, recites, "managing said identity 
profile comprises managing a certificate associated with said identity profile." Support for this 
claim can be found, inter alia, at pages 92-102 of the application. 

Claim 37, which depends from claim 1, recites "said first workflow comprises a 
predefined set of steps that perform said task, said predefined set of steps comprising a first step 
and a second step; said first step is performed by a first program; said second step is performed 
by a second program; and information is passed between said first program and said second 
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program according to a defined set of rules." Support for this claim can be found, inter alia, at 
lines 4-6 on page 36 of the application, and at lines 19-27 on page 49 of the application. 

Claim 38, which depends from claim 37, recites, "at least one of the first program 
and the second program is external to the workflow." Support for this claim can be found, inter 
alia, at lines 17-19 on page 47 of the application. 

m. Claim Rejections under 35 U.S.C. §103 

The office action rejected claims 1-33 under 35 U.S.C. § 103(a) as being 
unpatentable over US6,073,242 ("Hardy"), in view of Howes et al., Understanding and 
Deploying LDAP Directory Services , (Macmillan Computer Publishing 1999), ISBN 1-57870- 
070-1 ("Howes"). The applicants respectfully traverse the rejections and submit the following 
arguments in support of their position.. 

Even if combined in the manner contemplated by the office action, the cited 
combination fails to recite every element of any pending claim. Moreover, the office action fails 
to identify any permissible suggestion or motivation to combine the references in the 
contemplated manner. Hence, the applicants respectfully submit that the office action fails to 
establish a prima facie case of obviousness with respect to any pending claim, and that all 
pending claims therefore are patentable over the cited combination. 

In order to establish a prima facie case of obviousness, a proposed combination 

must meet three requirements: 

"First, there must be some suggestion or motivation, either in the 
references themselves or in the knowledge generally available to 
one of ordinary skill in the art, to modify the reference or to 
combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or 
references when combined) must teach or suggest all the claim 
limitations. The teaching or suggestion to make the claimed 
combination and the reasonable expectation of success must both 
be found in the prior art and not based on applicant's disclosure." 

MPEP § 706.02(j). The proposed combination fails to meet these requirements. 
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First, the proposed combination fails to teach or suggest each element of any 
pending claim. Merely by way of example, claim 1 recites, inter alia, "associating workflows 
with domains in a data structure." Neither reference recites this element of claim 1. The office 
action asserts that "Howes teaches a process of associating workflows with domains and 
apportioning data structures." It is difficult to see how the cited portion of Howes, which does 
not even mention either workflows or domains, possibly could disclose this element. 

The office action also asserts that "a workflow is understood as 'a process that is 
implemented by the Identity System (or other system) and automates the business methods.'" 
Assuming this characterization is correct (which the applicants do not concede), Howes does not 
teach or suggest the claim element recited above. While Howes does teach the concept of 
partitioned directories, nothing in the cited portion of Howes teaches that a workflow might be 
associated with a domain, as those terms are used in the claims, or, for that matter, even 
mentions the concept of automating business methods. 

Likewise, the applicants respectfully dispute the office action's contention that 
Hardy teaches "performing a first workflow for said task, said first workflow is associated with a 
first domain that includes the target of said request," as recited by claim 1 . Other than a bare 
mention that "[application of the present invention to other problems, such as . . . workflow, . . . 
is similar to the email case and therefore is not described at depth herein," (c. 8, 11. 41-45) 
(emphasis added) Hardy fails in its entirety to discuss how workflow processes might be 
implemented, so it is difficult to see how Hardy even discloses performing a workflow for a task, 
let alone performing a workflow associated with a domain that includes the target of a request. 

In forming the rejection, the office action posits that sending an email message 
(which is disclosed by Hardy) constitutes a workflow. The applicants respectfully submit that 
the mere task of sending an email message (even if it includes encrypting the message and 
appending a letterhead or a signature) does not teach or suggest a workflow, as that term is used 
in claim 1. As the office action perceives, sending an email message is perhaps a task, but it is 
not a workflow. (Hardy itself recognizes that the task of sending email, standing alone, is not a 
workflow, as shown by the passage at column 8, lines 41-45, quoted above, where Hardy 
describes workflow as an "other" problem separate from the problem of email transmission, to 
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which Hardy is directed). Hence, even taken together, Hardy and Howes fail to teach or suggest 
each element of even independent claim 1 . 

Moreover, the office action has identified no permissible suggestion or motivation 
to combine Hardy and Howes in the contemplated manner. The office action argues that "it 
would have been obvious ... to combine the workflow method of Hardy with the process of 
Howes, so that the user would have the benefit of simplified workflow processing and control 
over user roles." The office action, however, fails to identify or explain how incorporating the 
partitioned directory structure of Howes might provide the benefit of simplified workflow 
processing and control over user roles. Assuming Hardy did teach workflow processing (which, 
as noted above, it does not, other than a cursory mention that workflows might be implemented) 
and that Howes did teach associating a workflow with a domain (which, as noted above, it does 
not), the office action identifies nothing in Howes, Hardy or the art in general that would lead 
one skilled in the art to conclude that implementing Howes' directory structure might simplify 
any of the processes described by Hardy, let alone any workflow processes (which are not taught 
by Hardy, in any event). 

For at least these reasons, the applicants submit that the combination of Hardy and 
Howes does not create a prima facie case of obviousness under § 103(a) with respect to claim 1, 
and claim 1 therefore is believed to be allowable over the cited combination of Hardy and 
Howes. For at least similar reasons, independent claims 14 and 24 are believed to be allowable 
over the cited combination. 

Dependent claims 2-13, 15-23 and 25-38 are believed to be allowable as 
depending from allowable base claims and as being directed to specific novel substitutes. 
Merely by way of example, dependent claims 3, 16 and 26 recite "identifying one or more 
workflows associated with said target." Neither Hardy or Howes appears to teach this recitation. 
The office action states that "Hardy teaches a method of identifying applications associated with 
the target. . . . and associations of classes of users with applications . . . ." The cited portions of 
Hardy, however, do not appear to support the position taken by the office action. The cited 
portions of Hardy teach only that "[t]he server 102 also incorporates an authority application 
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154, which controls all exercise of enterprise authorities by the users Ui and coordinates all 
communications between the users Ui and their external correspondents" (c. 9, 11. 35-39), and 
"policy applications 170 [that] have features that can only be directed by respective classes of 
users according to a set of corporate policies" (c. 10, 11. 41-43). The use of an authority 
application to control the use of authorities does not teach identifying an application associated 
with a user, contrary to the position taken by the office action. If anything, it teaches identifying 
users allowed to use an various "authorities" (that is, various roles of authority within a 
company), not identifying applications that the users may use. 

More importantly, even assuming the office action's characterization of Hardy 
were correct, the applicants respectfully submit that the association of an application with a user 
does not teach or suggest identifying a workflow associated with a target, as claimed. Even if 
the "authorities" mentioned by Hardy were applications, the cited portion of Hardy merely 
teaches identifying users allowed to use those authorities, not targets of any application. 
Moreover, the passages cited by the office action deal with applications, not with workflows. 
Neither of these passages has anything to do with a workflow, let alone "identifying one or more 
workflows associated with [a] target," as recited by claims 3, 16 and 26. Those claims therefore 
are believed to be allowable for at least this additional reason. 

Nor does either Hardy or Howes teach "receiving from a user a selection of said 
first workflow," as recited by amended claims 7, 8, 18, 19, 28 and 29. In rejecting claim 7, the 
office action states that "Hardy teaches an example of the workflow method where selection of 
the first workflow is received, and one or more steps are performed." The cited portion of Hardy 
(c. 12, 11. 14-24), however, teaches receiving a "username for an external destination." Merely 
receiving a username is not the same as receiving a selection of a workflow, as recited by the 
claims. 

In rejecting claim 8, the office action states that Hardy discloses "applications 
require the intercession of the authority application, i.e., receiving a selection of a first 
workflow." Clearly, however, this disclosure fails to teach or suggest receiving from a user a 
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selection of a first workflow, as recited by the amended claims. Hence, amended claims 7, 8, 18, 
19, 28, 29 are believed to be allowable for at least this additional reason. 

Claims 9 and 20 recite, "said steps of associating, receiving and performing are 
performed by an integrated identity and access system," and claim 30 recites, "said one or more 
processors are part of an integrated identity and access system." These additional recitations are 
believed to render claims 9, 20 and 30 allowable over the cited references. In rejecting claim 9, 
the office action asserts that the authority server of Hardy teaches an "integrated identity and 
access system," as recited by these claims. Hardy (c. 5, 11. 6-14), however, describes its authority 
server only as a system "though which incoming and outgoing electronic communications are 
routed and, [that] in conjunction with [a] directory, performs whatever additional processing is 
required. The additional processing can include generating letterhead or authoritative signatures, 
encrypting the message, decrypting the message, logging the message or issuing binding 
electronic documents." In contrast, the present application describes an access system as 
"providing] security for resources across one or more Web Servers," and an identity system as 
"managing] identity profiles." (Application, p. 9, 11. 8-12) Hardy fails to teach or suggest that 
its authority server could perform any of these tasks. Instead, the authority server of Hardy 
merely serves as an electronic mail gateway and provides services relating to the transmission of 
electronic mail. Claims 9, 20 and 30, therefore are allowable for at least this additional reason. 

New claim 34 recites that "said target is a target identity profile, and . . . said task 
comprises managing said target identity profile." Neither Hardy nor Howes teaches performing 
a workflow for a task of managing an identity profile. Nor do the cited references, teach, 
individually or collectively, that workflows might perform tasks such as "creating a user, 
deleting a user, changing a user attribute, creating a group, deleting a group, and changing a 
group attribute," as recited by new claim 35. While Howes (p. 102) does teach that users might 
be created or deleted, neither reference discloses how a workflow might be performed to 
accomplish such tasks. The cited references also fail to teach or suggest that a workflow might 
perform a task of "managing a certificate associated with said identity profile," as recited by new 
claim 36. 
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New claim 37 defines a workflow as comprising "a predefined set of steps that 



perform said task, said predefined set of steps comprising a first step and a second step; said first 
step is performed by a first program; said second step is performed by a second program; and 
information is passed between said first program and said second program according to a defined 
set of rules." Neither Hardy nor Howes discloses the elements of claim 37. Nor do the cited 
„ references teach or suggest that "at least one of the first program and the second program is 
external to the workflow," as recited by claim 38. 



Hence, new claims 34-38 are believed to be allowable over the cited references 



IV. Conclusion 

For at least the above reasons, all claims currently pending in the application are 



believed to be allowable over the cited references, and the timely allowance of the pending 
claims is respectfully requested. If the Examiner believes a telephone conference would expedite 
prosecution of this application, please telephone the undersigned at 303-571-4000. 



TOWNSEND and TOWNSEND and CREW LLP 

Two Embarcadero Center, 8 th Floor 

San Francisco, California 941 1 1-3834 

Tel: 303-571-4000 

Fax:415-576-0300 

CEK:tnd 

60508040 v1 



for these additional reasons. 



Respectfully submitted, 




Reg. No. 44,187 
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